SAP September Patch Day<\/a> delivered 19 new Security Notes and four Critical vulnerabilities<\/a>, but the defining risk is not concentrated in a single product or technology. The highest-severity issues cut across infrastructure, cloud applications and client environments.<\/p>\n\n\n\n That distribution turns patch prioritisation into an architecture question. The speed of remediation increasingly depends on how clearly an organisation understands where exposure sits across its SAP landscape and the dependencies connecting it.<\/p>\n\n\n\n The cost of poor visibility is also rising as AI-enabled attacks shorten the cyber defence window<\/a>. September shows why: as the time available to address known weaknesses contracts, the time spent identifying exposure becomes part of the overall risk.<\/p>\n\n\n\n The two highest-scoring September vulnerabilities show why architecture visibility has become an important part of vulnerability management. Their severity is clear, but their practical exposure depends on where affected components sit within the SAP landscape.<\/p>\n\n\n\n The SAP Extended Passport Processing flaw, CVE-2026-44756<\/a>, is rated CVSS 10.0 and affects a broad range of SAP kernel and Web Dispatcher versions. Pathlock<\/a> describes it as a pre-authentication memory-corruption flaw in a request-processing path shared across NetWeaver AS ABAP and Java kernels and Web Dispatcher 9.16.<\/p>\n\n\n\n The SAP NetWeaver Message Server vulnerability, CVE-2026-58240<\/a>, is rated CVSS 9.8. An unauthenticated attacker with network access could connect an unauthorised server component and gain access to SAP system functions. Jonathan Stross, Senior Product Manager, Cybersecurity R&I at Pathlock<\/a>, describes Message Server as \u201cthe component every application server instance in a cluster implicitly trusts.\u201d<\/p>\n\n\n\n Pathlock places both flaws in its immediate remediation tier. Extended Passport requires visibility across affected kernel and Web Dispatcher deployments, while Message Server exposure depends on whether an attacker can reach the component in the first place.<\/p>\n\n\n\n The SAP Cloud Application Programming Model vulnerability moves the same visibility challenge into the application stack. The flaw, CVE-2026-76969<\/a>, is rated CVSS 9.4, but exposure is conditional. It affects multitenant CAP applications using vulnerable versions of the @sap\/cds-mtxs library with extensibility enabled.<\/p>\n\n\n\n Layer Seven Security<\/a> says SAP has blocked affected endpoints for applications running on BTP Cloud Foundry<\/a>. Customers still need to update the vulnerable component and redeploy affected applications, making remediation dependent on visibility into application versions and configurations.<\/p>\n\n\n\n Pathlock\u2019s broader September analysis also highlights a separate supply-chain concern involving compromised open-source npm packages used in SAP development tooling. Stross says at least five September items trace back to \u201copen-source dependencies rather than SAP\u2019s own code\u201d, reinforcing the importance of dependency inventories and version pinning as ongoing SAP security practices.<\/p>\n\n\n\n The issues are separate, but the implication is similar. Understanding SAP exposure increasingly requires visibility below the product level and into the software dependencies and configurations that applications inherit.<\/p>\n\n\n\n The fourth Critical vulnerability extends the visibility challenge into the client environment. The SAP GUI for Java flaw, CVE-2026-66768<\/a>, is rated CVSS 9.0 and can allow a low-privileged SAP user interacting with an untrusted system to execute unauthorised commands on a workstation. Exposure therefore depends partly on where affected clients are deployed and how they connect back into the SAP landscape.<\/p>\n\n\n\n SecurityBridge<\/a> places that client-side risk within a broader September pattern. Gert-Jan Koster, SAP Security Specialist at SecurityBridge, points to patches spanning on-premise systems, client devices and cloud services<\/a> as \u201ca clear example of the dynamic attack surface of a modern SAP landscape\u201d. That breadth makes vulnerability management dependent on visibility across systems that may be owned and maintained by different teams.<\/p>\n\n\n\n September therefore extends the architecture question from SAP infrastructure, through application dependencies, to the devices employees use to access those environments. Gaps at any of these layers can slow the path from vulnerability disclosure to remediation.<\/p>\n\n\n\n Patch Day tests architecture governance.<\/strong> Each monthly disclosure provides a recurring test of whether asset, dependency and client inventories are accurate enough to support rapid scoping. Repeated delays can expose structural visibility gaps before an incident does.<\/p>\n\n\n\n Ownership gaps extend the vulnerability window.<\/strong> When exposure crosses infrastructure, cloud development and endpoints, remediation speed depends on how quickly responsibility moves between teams. Organisations should treat hand-off delays as a potential security risk, rather than simply an operational inefficiency.<\/p>\n\n\n\n Visibility debt raises the cost of modernisation.<\/strong> As SAP estates add cloud services and software dependencies, undocumented connections accumulate alongside technical debt. Modernisation programmes that improve architecture records can therefore reduce future security response times as well as migration complexity.<\/p>\n","protected":false},"excerpt":{"rendered":" Key Takeaways \u21e8 SAP September Patch Day 2026 delivered 19 new Security Notes, including four Critical vulnerabilities spanning infrastructure, cloud applications and client environments. \u21e8 SAP architecture visibility is increasingly shaping vulnerability management by determining how quickly organisations can identify affected systems and dependencies. \u21e8 September\u2019s SAP security risks extend from NetWeaver infrastructure into cloud […]<\/p>\n","protected":false},"author":1,"featured_media":82,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"class_list":["post-81","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sap"],"_links":{"self":[{"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/posts\/81","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/comments?post=81"}],"version-history":[{"count":1,"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/posts\/81\/revisions"}],"predecessor-version":[{"id":83,"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/posts\/81\/revisions\/83"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/media\/82"}],"wp:attachment":[{"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/media?parent=81"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/categories?post=81"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/erp-news.com\/index.php\/wp-json\/wp\/v2\/tags?post=81"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Architecture Determines Where Critical Risk Lands<\/strong><\/h2>\n\n\n\n
Cloud Applications Extend Visibility Into the Dependency Layer<\/strong><\/h2>\n\n\n\n
Client Software Extends the SAP Security Boundary<\/strong><\/h2>\n\n\n\n
What This Means for ERP Insiders<\/strong><\/h2>\n\n\n\n